Getting Data In

Can i set a MAX MB or GB size per file?

Motivator

Hi

I have an issues that every now again one sourcetype can produce lots of bad data into the TB, Splunk will then take it in.
Is there a way to say MAX data to be taken in from one file is 10MB or something like that, so i am not collecting all this bad data?

Thanks in advance
Robert

0 Karma

SplunkTrust
SplunkTrust

No, there is no such feature. Splunk would have no way of telling good data from bad so it accepts everything.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Motivator

hi

Thanks for the answer.

I was more looking thinking from the the forwarder - to say 10 MB sent from one file so stop sending.

Regards
Robert Lynch

0 Karma

SplunkTrust
SplunkTrust

Still no such feature, but consider filing an Enhancement Request.

---
If this reply helps you, an upvote would be appreciated.
0 Karma